Draft
Security questionnaire, no SOC 2 yet?
By The Citesheet team · Published
Short answer
You can answer a security questionnaire without a SOC 2 report. Say No where that is true, describe what you do have, and give a plan with dates. Citesheet fills the answers your written policies can prove, quotes the proof, and lists the rest as gaps.
Your first enterprise customer just sent a spreadsheet with a few hundred security questions. One of the first asks for your SOC 2 report. You don't have one.
That's normal for a young company. A SOC 2 Type 2 report covers how your controls worked over a period, generally 6, 9 or 12 months. You can't get one by next week. You can still answer the questionnaire well.
What to do
- Say No where it's true. "No. We have not completed a SOC 2 audit." Not "in progress", not "compliant".
- Show what you do have. MFA, encryption, backups, who can reach production. Be specific.
- Point to written policies. If you do something but haven't written it down, write it down first.
- Give dates. "We plan to begin a Type 1 examination in Q2 2027" is a plan. "Planned" alone isn't.
- Offer a pen test summary and a call. A reviewer who can ask you questions is easier to convince than one who has to guess.
The full playbook, with sample wording for Yes, Partially and No, is in the guide: How to answer a security questionnaire without SOC 2.
The risk is overclaiming, not the No
An honest No with a dated plan is something a buyer can work with. A Yes you can't back up becomes a problem later, when they ask for evidence or write the answer into the contract.
That's also why guessing tools are risky here. A chatbot will happily write "Yes, we perform quarterly access reviews" if that sounds like a good answer. Whether you actually do is another matter.
How Citesheet helps
Citesheet fills your Excel questionnaire, such as a CAIQ, from your own documents. It works the way this situation needs:
- It answers only what your policies prove. Each answer comes with a word-for-word quote from your document, and code checks that the quote is really there.
- It says when it can't. If your documents don't support an answer, the row says "No proof found." It doesn't guess a Yes.
- You get a gap list. The "No proof found" rows show what to write down, what to fix, or what to answer No to, honestly.
- Your file comes back as you sent it. Same questions, same layout, same dropdowns.
On a 261-question CAIQ filled from GitLab's public policies, 158 of 163 filled answers matched GitLab's own answers. The method and the misses are on the benchmark page.
Your first questionnaire is free. After that, it's pilot pricing.